๐Ÿ”ง Modbus TCP/IP Interactive Training Tool

Master Operational Technology Communication Protocol

๐ŸŒ Modbus TCP/IP Protocol Overview

What is Modbus TCP/IP?

Modbus TCP/IP is an industrial communication protocol that enables automation devices to exchange data over TCP/IP networks. Developed in 1979 by Modicon (now Schneider Electric), it has become the de facto standard for industrial automation communications.

๐Ÿ“Š Protocol Stack

Application Layer
Modbus Application Protocol (MBAP)
Transport Layer
TCP (Port 502)
Network Layer
IP (Internet Protocol)
Data Link Layer
Ethernet Frame

๐Ÿ”ง Key Features

๐Ÿ“ฆ Data Types

Coils (0xxxx)

Read/Write single bits (digital outputs)

Example: Motor start/stop commands

Discrete Inputs (1xxxx)

Read-only single bits (digital inputs)

Example: Sensor status, limit switches

Input Registers (3xxxx)

Read-only 16-bit values (analog inputs)

Example: Temperature, pressure readings

Holding Registers (4xxxx)

Read/Write 16-bit values (analog outputs)

Example: Setpoints, configuration values

๐Ÿ”„ Communication Process

HMI/SCADA
(Client)
TCP/IP
Network
PLC/RTU
(Server)

1. Client sends request โ†’ 2. Server processes โ†’ 3. Server sends response

๐Ÿ”จ MBAP Header Builder

The Modbus Application Protocol (MBAP) header is 7 bytes long and precedes every Modbus TCP message.

Build Your Header

00 01
2 bytes - Unique identifier for request/response pairing
00 00
2 bytes - Always 0x0000 for Modbus
00 06
2 bytes - Number of bytes following this field
01
1 byte - Device address/identifier

Complete MBAP Header

00 01 00 00 00 06 01

This header would be followed by the Function Code and Data fields

๐Ÿ“– Header Field Explanations

Transaction Identifier

Allows client to match responses with requests. Critical for networks with multiple simultaneous transactions.

Protocol Identifier

Identifies the protocol being used. Always 0x0000 for standard Modbus operations.

Length Field

Specifies the number of bytes that follow this field, including Unit ID, Function Code, and Data.

Unit Identifier

Identifies the target device. Useful for Modbus gateways that bridge to serial devices.

โšก Protocol Operation Simulator

Build and Send Modbus Requests

๐Ÿ“‹ Common Function Codes

FC01 - Read Coils

Purpose: Read 1-2000 coil status

Use Case: Check motor running status, valve positions

FC03 - Read Holding Registers

Purpose: Read 1-125 holding registers

Use Case: Read setpoints, process values

FC06 - Write Single Register

Purpose: Write value to one register

Use Case: Set temperature setpoint, speed reference

FC16 - Write Multiple Registers

Purpose: Write values to multiple registers

Use Case: Configure multiple parameters at once

๐Ÿญ Real-World Applications

๐Ÿ”Œ Power Monitoring System

Scenario: Monitoring electrical consumption across a manufacturing facility

Setup: Power meters with Modbus TCP โ†’ Ethernet network โ†’ SCADA system

Data Exchanged: Voltage, current, power consumption, energy totals

Benefits: Real-time monitoring, automated reporting, predictive maintenance

๐Ÿ—๏ธ Building Automation

Scenario: HVAC control in a commercial building

Setup: Temperature controllers, damper actuators โ†’ Building management system

Data Exchanged: Temperature readings, setpoints, equipment status

Benefits: Energy efficiency, comfort control, maintenance scheduling

๐Ÿšฐ Water Treatment Plant

Scenario: Controlling pumps, valves, and monitoring water quality

Setup: PLCs controlling field devices โ†’ Central SCADA system

Data Exchanged: Flow rates, pressure, pH levels, pump status

Benefits: Process optimization, regulatory compliance, remote operation

๐Ÿญ Manufacturing Line

Scenario: Coordinating conveyor systems and assembly stations

Setup: Multiple PLCs โ†’ HMI stations โ†’ MES (Manufacturing Execution System)

Data Exchanged: Production counts, quality data, equipment status

Benefits: Production tracking, quality control, efficiency optimization

๐ŸŒ Typical Network Architecture

SCADA
Server
Ethernet
Switch
HMI
Stations
PLC #1
192.168.1.10
Gateway
PLC #2
192.168.1.11

๐Ÿ’ก Implementation Best Practices

๐Ÿง  Knowledge Assessment Quiz

1. What is the default TCP port for Modbus TCP/IP?

2. How many bytes is the MBAP header?

3. What function code is used to read holding registers?

4. In the MBAP header, what should the Protocol Identifier always be?

5. What communication model does Modbus TCP use?